Feature #37253
closed
katello-certs-check and foreman-installer --scenario katello should support not using chain
Description
`katello-certs-check` and `foreman-installer --scenario katello` should support not using chain certificate file.
Apache Httpd supports putting the chain in the same file as the leaf certificate. Supplying a chain file was even deprecated years ago.
`foreman-installer --scenario katello --certs-server-cert "/etc/pki/tls/certs/my_cert.pem" --certs-server-key /etc/pki/tls/private/my_key.pem` will run `katello-certs-check`.
`katello-certs-check` will complain about missing `-b CA_BUNDLE_FILE`.
https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcertificatefile
The files may also include intermediate CA certificates, sorted from leaf to root. This is supported with version 2.4.8 and later, and obsoletes SSLCertificateChainFile. When running with OpenSSL 1.0.2 or later, this allows to configure the intermediate CA chain on a per-certificate basis.
Furthermore, https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcertificatechainfile marks SSLCertificateChainFile as deprecated
Similar: https://projects.theforeman.org/issues/29279 - Drop use of SSLCertificateChainFile
Updated by Ewoud Kohl van Wijngaarden 6 months ago
- Related to Bug #29279: Drop use of SSLCertificateChainFile and combine CA certs added
Updated by Ewoud Kohl van Wijngaarden 6 months ago
- Status changed from New to Duplicate
I consider a duplicate of #29279.